mindvest-atlas 0.23.0 → 0.23.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindvest-atlas",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "description": "Atlas CLI \u2014 OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
   "type": "module",
   "bin": {

package/src/commands/remote-control.js

@@ -195,6 +195,7 @@ async function handleAsk(ask, root) {
           out = await sharing.publish(ask.job || '', root, {
             name: ask.name, description: ask.description || '', notes: ask.notes || '',
             asNew: Boolean(ask.as_new), force: Boolean(ask.force),
+            exclude: ask.exclude,
           });
         } else if (ask.op === 'unshare') out = await sharing.unpublish(ask.job || '', root);
         else if (ask.op === 'peek') out = await sharing.peek(ask.share || '', root);

package/src/commands/screenshot.js

@@ -28,8 +28,14 @@ export async function screenshotCommand(args) {
   const url = process.env.ATLAS_ASK_URL;
   const token = process.env.ATLAS_ASK_TOKEN;
   if (!url || !token) {
-    eprintln(color.red('Atlas Remote Control is not running, so nothing can draw the page.'));
-    eprintln(color.dim('Open it and turn Local Mode on, then try again.'));
+    // NOT a Local Mode check, whatever it used to say. These variables are
+    // handed to a process Atlas starts — a script it runs, or an agent it
+    // spawned. Their absence means this command is running somewhere Atlas did
+    // not start it, and saying "turn Local Mode on" sent people to a switch
+    // that was already on (owner, 2026-09-05).
+    eprintln(color.red('This has to run from inside Atlas. Atlas is what draws the page.'));
+    eprintln(color.dim('Ask for it in a chat, or call screenshot() from the project\'s script. '
+      + 'Run by hand in a terminal there is nothing to photograph.'));
     return 1;
   }
 

package/src/commands/share.js

@@ -25,6 +25,18 @@
 import { println } from '../util/ui.js';
 import * as sharing from '../sharing.js';
 
+/** `--hold-back a/b.py` or `--hold-back=a,b`, and `--hold-back=` meaning none.
+ *
+ *  undefined leaves the project's own choice alone; an EMPTY list is a real
+ *  instruction ("share everything") and has to survive the difference. */
+function holdBack(args) {
+  const raw = flag(args, 'hold-back', 'hold_back', 'exclude');
+  if (raw === undefined) return undefined;
+  if (typeof raw === 'boolean') return [];
+  const items = Array.isArray(raw) ? raw : String(raw).split(',');
+  return items.map((x) => String(x).trim()).filter(Boolean);
+}
+
 function flag(args, ...names) {
   for (const name of names) {
     const value = args.flags[name];
@@ -38,6 +50,7 @@ const SUB_HELP = `atlas share <state|publish|off|peek|file|install|updates|fetch
   state    --job <name>                 is this project shared, and its link
   publish  --job <name> [--notes …]     put the current files out as a new version
            [--as-new] [--force] [--name …] [--description …]
+           [--hold-back runs,notes.md]  files to leave out (kept in atlas.json)
   off      --job <name>                 stop sharing; the link stops working
   peek     --link <id:token>            download and describe, without installing
   file     --package <id> --path <p>    one file's text from a downloaded package
@@ -67,6 +80,7 @@ export async function shareCommand(args) {
         notes: String(flag(args, 'notes') || ''),
         asNew: Boolean(flag(args, 'as-new', 'as_new', 'new')),
         force: Boolean(flag(args, 'force')),
+        exclude: holdBack(args),
       });
       break;
     case 'off':

package/src/config.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import os from 'node:os';
 
-export const VERSION = '0.23.0';
+export const VERSION = '0.23.2';
 export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
 export const DEFAULT_SCOPE = 'atlas broker';
 export const CLIENT_NAME = 'Atlas CLI';

package/src/remote-control.js

@@ -1190,8 +1190,8 @@ export async function askModel(prompt, { job = '', tools = true, fresh = false,
   const token = process.env.ATLAS_ASK_TOKEN;
   if (!url || !token) {
     throw new Error(
-      'No model is connected on this computer. Open Atlas Remote Control, '
-      + 'connect a model, and turn Local Mode on.'
+      'This script is not running through Atlas, so it has no way to reach a model. '
+      + 'Press Run in Atlas, or let its schedule start it.'
     );
   }
   const res = await fetch(url, {
@@ -1240,8 +1240,8 @@ export async function chatModel(prompt, onEvent, { job = '', model = '', timeout
   const token = process.env.ATLAS_ASK_TOKEN;
   if (!url || !token) {
     onEvent({ kind: 'error', message:
-      'No model is connected on this computer. Open Atlas Remote Control, '
-      + 'connect a model, and turn Local Mode on.' });
+      'This is not running through Atlas, so it has no way to reach a model. '
+      + 'Press Run in Atlas, or let its schedule start it.' });
     return;
   }
   try {

package/src/sharing.js

@@ -77,8 +77,53 @@ export function writePin(dir, pin) {
 
 // ── packing ────────────────────────────────────────────────────────────────
 
-/** Every file that may leave the machine, as POSIX relative paths. */
-export function packableFiles(dir) {
+/** Where a project remembers what its author holds back. In `atlas.json`, with
+ *  the schedule and the run line, because it is a setting OF the project and a
+ *  person may want to read or change it without opening a screen. */
+export const EXCLUDE_KEY = 'share_exclude';
+
+/** Paths this project's author has chosen not to share. Never a secret list:
+ *  the hard rules (.env, .venv, the dot folders) are not in here and cannot be,
+ *  because a preference must not be the thing standing between a key and a
+ *  stranger. */
+export function readExclude(dir) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(path.join(dir, 'atlas.json'), 'utf8'));
+    const items = raw && typeof raw === 'object' ? raw[EXCLUDE_KEY] : null;
+    if (!Array.isArray(items)) return [];
+    return [...new Set(items.map((x) => String(x).trim().replace(/^\/+|\/+$/g, '')).filter(Boolean))].sort();
+  } catch { return []; }
+}
+
+/** Remember the choice, so the next publish holds the same things back. */
+export function writeExclude(dir, paths) {
+  const file = path.join(dir, 'atlas.json');
+  let raw = {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) raw = parsed;
+  } catch { raw = {}; }
+  const clean = [...new Set((paths || []).map((x) => String(x).trim().replace(/^\/+|\/+$/g, '')).filter(Boolean))].sort();
+  if (clean.length) raw[EXCLUDE_KEY] = clean; else delete raw[EXCLUDE_KEY];
+  try {
+    fs.writeFileSync(file, JSON.stringify(raw, null, 2));
+    return true;
+  } catch { return false; }
+}
+
+/** Is this file one the author left out — itself, or a folder holding it? */
+const heldBack = (rel, exclude) =>
+  (exclude || []).some((item) => rel === item || rel.startsWith(`${item}/`));
+
+/**
+ * Every file that may leave the machine, as POSIX relative paths.
+ *
+ * `exclude` is the author's own choice on top of the relay filter, and only
+ * ever SUBTRACTS. Nothing a person can tick makes a `.env` shareable: the two
+ * are different kinds of rule and are kept apart on purpose.
+ */
+export function packableFiles(dir, exclude) {
+  const held = exclude === undefined ? readExclude(dir) : (exclude || []);
   const out = [];
   const walk = (at, prefix) => {
     let items = [];
@@ -90,6 +135,7 @@ export function packableFiles(dir) {
       if (item.isDirectory()) { walk(path.join(at, item.name), rel); continue; }
       if (!item.isFile() || isSecret(item.name)) continue;
       if (parts.length === 1 && HELPERS.has(item.name)) continue;
+      if (heldBack(rel, held)) continue;
       out.push(rel);
     }
   };
@@ -121,12 +167,16 @@ export function requiredKeys(dir, files) {
   return [...names].filter((n) => !n.startsWith('ATLAS_')).sort();
 }
 
-export function packProject(job, root, { name, description = '' } = {}) {
+export function packProject(job, root, { name, description = '', exclude } = {}) {
   const dir = projectDir(job, root);
   if (!fs.existsSync(dir)) return { ok: false, error: `There is no project called ${job} here.` };
-  const files = packableFiles(dir);
+  const files = packableFiles(dir, exclude);
   if (!files.length) {
-    return { ok: false, error: 'This project has nothing in it yet, so there is nothing to share.' };
+    return {
+      ok: false,
+      error: 'Nothing would be shared. Every file in this project is either held back '
+           + 'or one Atlas never shares.',
+    };
   }
   const hashes = {};
   const entries = [];
@@ -150,8 +200,14 @@ export function packProject(job, root, { name, description = '' } = {}) {
 
 // ── publishing ─────────────────────────────────────────────────────────────
 
-export async function publish(job, root, { name, description = '', notes = '', asNew = false, force = false } = {}) {
+export async function publish(job, root, {
+  name, description = '', notes = '', asNew = false, force = false, exclude,
+} = {}) {
   const dir = projectDir(job, root);
+  // The choice is REMEMBERED before it is used, so the next publish holds the
+  // same things back without being told again — and so a person can read it in
+  // atlas.json rather than having to open a screen to find out.
+  if (exclude !== undefined && exclude !== null) writeExclude(dir, exclude);
   const packed = packProject(job, root, { name, description });
   if (!packed.ok) return packed;
 
@@ -219,11 +275,31 @@ export async function unpublish(job, root) {
   return { ok: true };
 }
 
+/**
+ * Is this project shared, from where, and exactly what would go.
+ *
+ * The file list comes back with it so the share screen can show what is IN a
+ * publish before it happens — and let the author take something out. It is the
+ * real packing list, not a guess at one: the same call that packs produces it.
+ */
 export function shareState(job, root) {
-  const pin = readPin(projectDir(job, root));
-  if (!pin) return { ok: true, shared: false, mine: true };
-  return {
+  const dir = projectDir(job, root);
+  const exclude = readExclude(dir);
+  const shareable = packableFiles(dir, []);
+  const base = {
     ok: true,
+    shared: false,
+    mine: true,
+    // Every file that COULD go, whether or not it is going. NOT `files`: that
+    // word already means "what is in a package" on the peek side, and one name
+    // with two meanings is a bug waiting for a careless reader.
+    shareable,
+    exclude: exclude.filter((x) => shareable.some((f) => f === x || f.startsWith(`${x}/`))),
+  };
+  const pin = readPin(dir);
+  if (!pin) return base;
+  return {
+    ...base,
     shared: Boolean(pin.share),
     share: pin.share,
     package_id: pin.package_id,
@@ -313,7 +389,7 @@ export async function peek(shareText, root) {
 export function peekRead(packageId, filePath, root) {
   const zipPath = path.join(stagingDir(root, packageId), 'package.zip');
   if (!fs.existsSync(zipPath)) {
-    return { ok: false, error: 'Open the link again — this download has gone.' };
+    return { ok: false, error: 'Open the link again: this download has gone.' };
   }
   try {
     const found = unzip(fs.readFileSync(zipPath)).find((e) => e.name === filePath);
@@ -370,7 +446,7 @@ export function install(packageId, root, { job } = {}) {
   const stage = stagingDir(root, packageId);
   const zipPath = path.join(stage, 'package.zip');
   if (!fs.existsSync(zipPath)) {
-    return { ok: false, error: 'Open the link again — this download has gone.' };
+    return { ok: false, error: 'Open the link again: this download has gone.' };
   }
   let manifest = {};
   try {